Skip to content

Knowledge base · AI in HR

May recruiters paste CVs or candidate data into ChatGPT or another AI chatbot?

Only within the limits of the GDPR. You use candidate data only for the purpose for which you received it and no more than necessary. An external chatbot service that processes that data for you is a processor; for that you need a data processing agreement, and where processing takes place outside the EU the rules on transfers apply. An account without such agreements is not suitable for this. If you let the chatbot assess or filter candidates, from 2 December 2027 you can also become the provider of a high-risk system yourself.

In force now (since 25 May 2018)Trusq editorial · checked against the official textLast verified:

Next step: Map your AI tool

Purpose limitation and minimal data

Personal data is collected for specified purposes and not further processed in a manner that is incompatible with those purposes [1]. Do not use more data than necessary [2]: remove name, address and other identifying data if the question can be answered without it.

The chatbot service as a processor

If you let the service process data for you, you engage only a processor that provides sufficient guarantees [3], and you record that it processes only on your instructions [4]. If the service offers no data processing agreement, or uses input for its own purposes, it is not suitable for candidate data.

Outside the EU

If the data is processed outside the EU, that is allowed only under the conditions for transfers [5].

Assessing or filtering with a chatbot

Anyone who changes the intended purpose of a general-purpose AI system so that it becomes a high-risk system counts as a provider [6]. Recruitment and selection are on the high-risk list [7]; those rules apply from 2 December 2027 [8].

Working agreements

Make clear agreements with recruiters about which tools they may use and with what data. That fits the AI literacy measures you are already taking now [9].

What Trusq bases this on

These released rules are in Trusq and are read again with every publication; if a rule changes, this page changes with it.

  • Risk of becoming a provider AI Act 3, AI Act 25
  • Literacy programme AI Act 4

Sources

  1. [1] GDPR Art. 5(1)(b) (General Data Protection Regulation (GDPR), Regulation (EU) 2016/679). Purpose limitation.
    (b) collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes;
    Source, retrieved on 3 October 2026.
  2. [2] GDPR Art. 5(1)(c) (General Data Protection Regulation (GDPR), Regulation (EU) 2016/679). Data minimisation.
    (c) adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed (‘data minimisation’);
    Source, retrieved on 3 October 2026.
  3. [3] GDPR Art. 28(1) (General Data Protection Regulation (GDPR), Regulation (EU) 2016/679). Only processors that provide sufficient guarantees.
    1. Where processing is to be carried out on behalf of a controller, the controller shall use only processors providing sufficient guarantees to implement appropriate technical and organisational measures in such a manner that processing will meet the requirements of this Regulation and ensure the protection of the rights of the data subject.
    Source, retrieved on 3 October 2026.
  4. [4] GDPR Art. 28(3)(a) (General Data Protection Regulation (GDPR), Regulation (EU) 2016/679). The processor processes only on documented instructions.
    That contract or other legal act shall stipulate, in particular, that the processor: (a) processes the personal data only on documented instructions from the controller, including with regard to transfers of personal data to a third country or an international organisation,
    Source, retrieved on 3 October 2026.
  5. [5] GDPR Art. 44 (General Data Protection Regulation (GDPR), Regulation (EU) 2016/679). A transfer to a third country is allowed only under the conditions of Chapter V.
    Any transfer of personal data which are undergoing processing or are intended for processing after transfer to a third country or to an international organisation shall take place only if, subject to the other provisions of this Regulation, the conditions laid down in this Chapter are complied with by the controller and processor,
    Source, retrieved on 3 October 2026.
  6. [6] AI Act Art. 25(1) (AI Act, Regulation (EU) 2024/1689). Anyone who changes the intended purpose of an AI system, including a general-purpose AI system, so that it becomes high-risk counts as a provider.
    Any distributor, importer, deployer or other third-party shall be considered to be a provider of a high-risk AI system for the purposes of this Regulation and shall be subject to the obligations of the provider under Article 16, in any of the following circumstances: […] (c) they modify the intended purpose of an AI system, including a general-purpose AI system, which has not been classified as high-risk and has already been placed on the market or put into service in such a way that the AI system concerned becomes a high-risk AI system in accordance with Article 6.
    Source, retrieved on 3 October 2026.
  7. [7] AI Act, Annex III, point 4(a) (AI Act, Regulation (EU) 2024/1689). AI for recruitment or selection is listed in Annex III.
    AI systems intended to be used for the recruitment or selection of natural persons, in particular to place targeted job advertisements, to analyse and filter job applications, and to evaluate candidates;
    Source, retrieved on 3 October 2026.
  8. [8] Regulation (EU) 2026/1744 Art. 1(40)(b) (replaces AI Act Art. 113, third paragraph, point (c)) (Regulation (EU) 2026/1744 (Digital Omnibus on AI)). The high-risk rules (Chapter III, Sections 1 to 3) apply to Annex III systems from 2 December 2027.
    Chapter III, Sections 1, 2, and 3, with the exception of Article 6(5), shall apply from: (i) 2 December 2027 as regards AI systems classified as high-risk pursuant to Article 6(2) and Annex III; and
    Source, retrieved on 3 October 2026.
  9. [9] Regulation (EU) 2026/1744 Art. 1(5) (replaces AI Act Art. 4(1)) (Regulation (EU) 2026/1744 (Digital Omnibus on AI)). Deployers take measures that support the development of AI literacy.
    Providers and deployers of AI systems shall take measures to support the development of AI literacy of their staff and other persons dealing with the operation and use of AI systems on their behalf, taking into account their technical knowledge, experience, education and training and the context the AI systems are to be used in, and considering the persons or groups of persons on whom the AI systems are to be used.
    Source, retrieved on 3 October 2026.

Related questions

We are buying an AI tool for HR. Are we then the provider or the deployer?What do we agree with the supplier of an AI tool for HR?Do we have to make our HR team AI literate if we use AI tools?May software automatically reject applicants without a person looking at it?

Next step

Describe one AI tool, for example your recruitment or planning software, in four questions. You see at once which rules may apply, with the source, before you enter any data.

Map your AI tool

Looking for a specialist? We will look with you for a suitable specialist; mediation is not guaranteed.

This page gives general information based on the text of the law. It is not legal advice for your situation.